CVE Watch15 oct 2026

CVE-2026-103226

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdev

CVSS

6.3

Medio

EPSS

0.5%

p43

KEV

—

Exploit Today

0-100

Publicado: 30 sept 2026 · Última mod.: 15 oct 2026 · CWE-119 · CWE-121

EPSS · 30d

0.4%EPSS · 30 días0.5%

2026-10-012026-10-20

Descripción técnica

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-11374410.0 CRÍ

—

——0A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.11h CVE-2026-938887.8 ALT

—

——0IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.15h CVE-2026-765878.8 ALT

—

——0IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.15h CVE-2026-1133438.8 ALT

—

——0Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)9h CVE-2026-1133429.6 CRÍ

—

——0Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)12h CVE-2026-113341—

—

——0Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)15h